[et_pb_section bb_built=”1″ inner_width=”auto” inner_max_width=”1080px”][et_pb_row][et_pb_column type=”4_4″ custom_padding__hover=”|||” custom_padding=”|||”][et_pb_text admin_label=”Breadcrumb” _builder_version=”4.27.4″ background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” text_text_shadow_horizontal_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength=”text_text_shadow_style,%91object Object%93″ text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength=”link_text_shadow_style,%91object Object%93″ link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength=”header_text_shadow_style,%91object Object%93″ header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ z_index_tablet=”0″]<\/p>\n
Scientific Computing and Data<\/a>\u00a0\/\u00a0High Performance Computing<\/a>\u00a0\/ NIST SP 800-171\u00a0<\/p>\n <\/p>\n [\/et_pb_text][et_pb_text _builder_version=”4.27.4″ background_pattern_color=”rgba(0,0,0,0.2)” background_mask_color=”#ffffff” text_text_shadow_horizontal_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_horizontal_length_tablet=”0px” text_text_shadow_vertical_length=”text_text_shadow_style,%91object Object%93″ text_text_shadow_vertical_length_tablet=”0px” text_text_shadow_blur_strength=”text_text_shadow_style,%91object Object%93″ text_text_shadow_blur_strength_tablet=”1px” link_text_shadow_horizontal_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_horizontal_length_tablet=”0px” link_text_shadow_vertical_length=”link_text_shadow_style,%91object Object%93″ link_text_shadow_vertical_length_tablet=”0px” link_text_shadow_blur_strength=”link_text_shadow_style,%91object Object%93″ link_text_shadow_blur_strength_tablet=”1px” ul_text_shadow_horizontal_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_horizontal_length_tablet=”0px” ul_text_shadow_vertical_length=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_vertical_length_tablet=”0px” ul_text_shadow_blur_strength=”ul_text_shadow_style,%91object Object%93″ ul_text_shadow_blur_strength_tablet=”1px” ol_text_shadow_horizontal_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_horizontal_length_tablet=”0px” ol_text_shadow_vertical_length=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_vertical_length_tablet=”0px” ol_text_shadow_blur_strength=”ol_text_shadow_style,%91object Object%93″ ol_text_shadow_blur_strength_tablet=”1px” quote_text_shadow_horizontal_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_horizontal_length_tablet=”0px” quote_text_shadow_vertical_length=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_vertical_length_tablet=”0px” quote_text_shadow_blur_strength=”quote_text_shadow_style,%91object Object%93″ quote_text_shadow_blur_strength_tablet=”1px” header_text_shadow_horizontal_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_horizontal_length_tablet=”0px” header_text_shadow_vertical_length=”header_text_shadow_style,%91object Object%93″ header_text_shadow_vertical_length_tablet=”0px” header_text_shadow_blur_strength=”header_text_shadow_style,%91object Object%93″ header_text_shadow_blur_strength_tablet=”1px” header_2_text_shadow_horizontal_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_horizontal_length_tablet=”0px” header_2_text_shadow_vertical_length=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_vertical_length_tablet=”0px” header_2_text_shadow_blur_strength=”header_2_text_shadow_style,%91object Object%93″ header_2_text_shadow_blur_strength_tablet=”1px” header_3_text_shadow_horizontal_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_horizontal_length_tablet=”0px” header_3_text_shadow_vertical_length=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_vertical_length_tablet=”0px” header_3_text_shadow_blur_strength=”header_3_text_shadow_style,%91object Object%93″ header_3_text_shadow_blur_strength_tablet=”1px” header_4_text_shadow_horizontal_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_horizontal_length_tablet=”0px” header_4_text_shadow_vertical_length=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_vertical_length_tablet=”0px” header_4_text_shadow_blur_strength=”header_4_text_shadow_style,%91object Object%93″ header_4_text_shadow_blur_strength_tablet=”1px” header_5_text_shadow_horizontal_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_horizontal_length_tablet=”0px” header_5_text_shadow_vertical_length=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_vertical_length_tablet=”0px” header_5_text_shadow_blur_strength=”header_5_text_shadow_style,%91object Object%93″ header_5_text_shadow_blur_strength_tablet=”1px” header_6_text_shadow_horizontal_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_horizontal_length_tablet=”0px” header_6_text_shadow_vertical_length=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_vertical_length_tablet=”0px” header_6_text_shadow_blur_strength=”header_6_text_shadow_style,%91object Object%93″ header_6_text_shadow_blur_strength_tablet=”1px” box_shadow_horizontal_tablet=”0px” box_shadow_vertical_tablet=”0px” box_shadow_blur_tablet=”40px” box_shadow_spread_tablet=”0px” vertical_offset_tablet=”0″ horizontal_offset_tablet=”0″ z_index_tablet=”0″]<\/p>\n Some research datasets\u2014particularly genomic and other sensitive datasets provided by the federal government\u2014have additional security requirements<\/strong>. If you plan to bring this type of data into Mount Sinai, you may be required to use a specially secured computing environment and complete an institutional approval process before you can access the data.<\/span><\/p>\n NIST SP 800-171<\/strong> is a set of cybersecurity requirements developed by the National Institute of Standards and Technology (NIST)<\/strong>. It describes how organizations should protect certain sensitive federal information when that information is stored, processed, or transmitted on systems outside the federal government.<\/span> (NIST Computer Security Resource Center<\/a>)<\/p>\n Think of it as a security checklist for protecting sensitive federal data<\/strong>. It covers areas such as:<\/span><\/p>\n Access control<\/strong> \u2014 making sure only authorized people can access the data<\/span><\/p>\n<\/li>\n Identification and authentication<\/strong> \u2014 securely verifying who users are<\/span><\/p>\n<\/li>\n Audit and accountability<\/strong> \u2014 keeping records of access and activity<\/span><\/p>\n<\/li>\n Configuration management<\/strong> \u2014 maintaining secure system configurations<\/span><\/p>\n<\/li>\n Incident response<\/strong> \u2014 detecting and responding to security incidents<\/span><\/p>\n<\/li>\n Media protection<\/strong> \u2014 protecting data stored on devices and other media<\/span><\/p>\n<\/li>\n System and communications protection<\/strong> \u2014 securing data while it is being transmitted<\/span><\/p>\n<\/li>\n Personnel security<\/strong> \u2014 addressing risks associated with people who have access to the information<\/span><\/p>\n<\/li>\n<\/ul>\n NIST SP 800-171 Rev. 3, published in 2024, contains the current set of requirements and supersedes the earlier Rev. 2.<\/span> (NIST Computer Security Resource Center<\/a>)<\/p>\n If you receive restricted data from a federal data repository<\/strong>, you cannot necessarily download it to your normal computer, Mount Sinai server, or standard research environment.<\/span><\/p>\n Instead, the data may need to be:<\/span><\/p>\n Approved for use by Mount Sinai<\/strong><\/span><\/p>\n<\/li>\n Transferred through an approved process<\/strong><\/span><\/p>\n<\/li>\n Stored and analyzed in a NIST SP 800-171-compliant environment<\/strong><\/span><\/p>\n<\/li>\n Accessed only by appropriately authorized researchers<\/strong><\/span><\/p>\n<\/li>\n<\/ol>\n For Mount Sinai, Minerva-Res<\/strong><\/a> is the designated environment for research requiring this level of security.<\/span><\/p>\n A federal genomic data repository<\/strong> is a government-controlled database that stores genomic or other sensitive research data. One example is NIH dbGaP (Database of Genotypes and Phenotypes)<\/strong>.<\/span><\/p>\n These repositories may contain highly sensitive information, including genetic information and associated clinical or research data. Access is therefore subject to additional security and data-use requirements.<\/span><\/p>\n NOT-OD-24-157<\/strong><\/a> is an NIH policy notice concerning security requirements for certain controlled-access data obtained from NIH repositories. In practical terms, it means that researchers and institutions need to make sure that the environment used to store and work with certain NIH-controlled data meets the required security standards<\/strong>.<\/span><\/p>\n A Data Use Certification (DUC)<\/strong> is a formal certification that describes how researchers will use and protect controlled-access data.<\/span><\/p>\n In simple terms, it says:<\/span><\/p>\n \u201cWe agree to use this data only for the approved research purpose and to protect it according to the applicable requirements.\u201d<\/strong><\/span><\/p>\n A Data Use Agreement (DUA)<\/strong> is a formal agreement governing how data can be accessed, used, stored, and shared.<\/span><\/p>\n It typically specifies things such as:<\/span><\/p>\n Who may access the data<\/span><\/p>\n<\/li>\n What the data may be used for<\/span><\/p>\n<\/li>\n How the data must be protected<\/span><\/p>\n<\/li>\n Whether the data can be shared<\/span><\/p>\n<\/li>\n How long the data may be retained<\/span><\/p>\n<\/li>\n What happens if the terms of the agreement are violated<\/span><\/p>\n<\/li>\n<\/ul>\n A Data Transfer Use Agreement (DTUA)<\/strong> governs the transfer of data from one organization to another<\/strong>.<\/span><\/p>\n It establishes the conditions under which the data can be transferred and the responsibilities of the organizations receiving and protecting it.<\/span><\/p>\n A Data Provision Agreement (DPA)<\/strong> is an agreement that establishes the conditions under which data is provided to the researcher or institution<\/strong>.<\/span><\/p>\n The exact agreement required depends on the source of the data and the circumstances under which it is being provided.<\/span><\/p>\n Do not transfer or download the data into a standard research environment before obtaining approval.<\/strong><\/span><\/p>\n Instead:<\/span><\/p>\n Determine what agreements or certifications are required for your dataset.<\/span><\/p>\n<\/li>\n Work with your <\/span>GCO Contracts Specialist<\/a><\/strong> or<\/span> AOR <\/a><\/strong>(Authorized Organizational Representative)<\/strong> to complete the institutional approval process.<\/span><\/p>\n<\/li>\n Once approved, work with the appropriate Mount Sinai research computing team to use Minerva-Res<\/strong><\/a>, the designated NIST SP 800-171 environment.<\/span><\/p>\n<\/li>\n Keep the data within the approved environment and follow all requirements of the applicable data-use agreement.<\/span><\/p>\n<\/li>\n<\/ul>\n If your research involves restricted federal data, the important point is:<\/span><\/strong><\/p>\n Get institutional approval first and use the appropriate secure computing environment. For NIST SP 800-171\u2013controlled data at Mount Sinai, that environment is Minerva-Res.<\/a><\/strong><\/span><\/p>\n The security requirements are not simply an IT preference\u2014they are part of the conditions under which certain federal data may be accessed and used. NIST describes SP 800-171 as requirements for protecting Controlled Unclassified Information (CUI) in nonfederal systems.<\/span> (NIST Computer Security Resource Center<\/a>)<\/p>\n One terminology note:<\/strong> NIST SP 800-171<\/em> is the name of the NIST publication; NIST<\/strong> stands for National Institute of Standards and Technology<\/em>, and SP<\/strong> stands for Special Publication<\/em>.<\/span><\/p>\n [\/et_pb_text][\/et_pb_column][\/et_pb_row][\/et_pb_section]<\/p>\n","protected":false},"excerpt":{"rendered":"What You Need to Know About Accessing Restricted Federal Research Data<\/span><\/strong><\/h1>\n
\u00a0<\/h3>\n
What is NIST SP 800-171?<\/span><\/strong><\/h3>\n
\n
\u00a0<\/h3>\n
What does this mean for researchers?<\/span><\/strong><\/h3>\n
\n
\u00a0<\/h3>\n
What is a federal genomic data repository?<\/span><\/strong><\/h3>\n
\u00a0<\/h3>\n
What is NIH Notice NOT-OD-24-157?<\/span><\/strong><\/h3>\n
\u00a0<\/h3>\n
What is a Data Use Certification (DUC)?<\/span><\/strong><\/h3>\n
\u00a0<\/h3>\n
What is a Data Use Agreement (DUA)?<\/span><\/strong><\/h3>\n
\n
\u00a0<\/h3>\n
What is a Data Transfer Use Agreement (DTUA)?<\/span><\/strong><\/h3>\n
\u00a0<\/h3>\n
What is a Data Provision Agreement (DPA)?<\/span><\/strong><\/h3>\n
\u00a0<\/h3>\n
What should I do if I want to use this type of data?<\/span><\/strong><\/h3>\n
\n
\u00a0<\/h3>\n
Summary<\/strong><\/span><\/h3>\n